HackingData MishandlingData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Orrstown Bank
bd_982b58c02c6fe7d9 · schema v1 · pii pii-v1
Full breach record for Orrstown Bank →Orrstown Bank notified the New Hampshire Attorney General on June 11, 2026, of a data security incident involving its third-party vendor, Mercadien, P.C. CPAs. On May 21, 2026, Mercadien experienced unauthorized access to sensitive personal information belonging to 19 New Hampshire residents. Orrstown's own systems were not compromised. The incident involved names, dates of birth, addresses, SSNs, account numbers, and government IDs. No misuse has been identified. Orrstown offered 24 months of identity theft protection via Experian.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_9c592a5b5bce08e7Vermont State AGfiled 2026-06-12(3d gap)Verified
- bd_ad55cfde4c9662f5Indiana State AGfiled 2026-06-11(4d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/orrstown-bank-20260615.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 15, 2026
- Raw hash
- 5af1980d7f76ed61a042d68aec26cc5a6aed5a0af0ee735f96d92c109d8876a0
Reporting entity
- Name
- Orrstown Banknorm: orrstown bank
Victim entity
- Name
- Orrstown Banknorm: orrstown bank
Incident
- Discovered
- May 21, 2026
- Materiality determined
- —
- Notification sent
- Jun 11, 2026
- Affected individuals
- 19
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Filed Security Incident Notification with New Hampshire Attorney General
- Third party
- via Mercadien, P.C. CPAs
- Initial access
- supply_chain
Compliance
- Time to disclose
- 25 days(25 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.